Backdoor file detection method and backdoor file detection device

Abstract

The invention provides a backdoor file detection method and a backdoor file detection device, and the method may comprise the following steps: acquiring website logs aiming at access records of a file; extracting submitted data in the website logs; detecting whether the file is a suspicious backdoor file based on the submitted data, and when the file is the suspicious backdoor file, determining whether the suspicious backdoor file is a backdoor file based on the submitted data. Through the technical scheme provided by the invention, the backdoor file can be identified accurately, and securityof a website can be guaranteed.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a detection method and device for a backdoor file. Background technique [0002] Web shell (website backdoor) files are also called webpage backdoor files, which are usually written in the same programming language as the website language. After hackers invade a website, they usually put the backdoor files in a hidden directory to achieve control Purpose of the Site. [0003] In the prior art, in order to prevent the backdoor file uploaded to the website from being discovered and used by other hackers, the hacker will write an identity verification program in the backdoor file, then the hacker who accesses the backdoor file must enter the correct password, and the backdoor file will be Execute the real backdoor code. There are more full-featured webpage Trojan horses that appear at present, that is, Trojan horses with common functions of hackers such as direc...

AI Technical Summary

Problems solved by technology

[0004] This application provides a detection method and device for backdoor files to solve the problems in the prior art of identifying backdoor files such as backdoor files that are not accurate enough and prone to misjudgment

Images